coralreef
Joined 13 years ago
Joined 13 years ago
The short but final answer: because other people want it.
Fake zoom updates: https://www.malwarebytes.com/blog/scams/2026/02/fake-zoom-me...
NPM supply chain attack targeting cryptowallets: https://www.paloaltonetworks.com/blog/cloud-security/npm-sup...
More software means more complexity means more pathways to losing.
Can you do it? Sure. I'm sure there are millions of dollars in private keys stored on internet connected laptops somewhere out there. But the best practices remain the same: as little internet as possible, as little software as possible.
To continue with your example, "display sniffing" could be done by infecting trusted software or software presented as trustworthy (fake or infected Zoom binaries, Xcode binaries, etc.) or injected through open source dependencies like npm packages.
Yes, you or I might be paranoid enough to check the checksum hash to make sure the open source code matches the build. But every time, for everything?
The less connected it is, the safer. The less software it runs, the safer.
Sounds kinda clunky.
But now you need to generate a public key to send to someone so you can receive coins. How are you sending that key to your friend? Are you going to read character by character and manually type up the string?
It's all tradeoffs.
Thus the attack surface is far greater.
~70% of int'l marriages in Japan are Japanese men + foreign brides.
Of the women marrying foreign husbands, 25.7% Korean, next is 16.7% American, then 12.5% Chinese.
DJI and Insta360 offer compelling products. And budget, lower quality 1080p-4k action cams got eaten by Akaso and other clones.
You can have an opinion on whether or not AI/data centers are worthwhile, but ultimately it wasn't made by your money.